WebSense数据防泄漏系统部署指南

Deployment Guide Websense® TRITON®AP-DATA Gateway and Discoverv8.0.x©1996–2014, Websense, Inc.All rights reserved.10900 Stonelake Blvd, 3rd Floor, Austin, TX 78759, USAPublished December 2014Printed in the United States and IrelandThe products and/or methods of use described in this document are covered by U.S. Patent Numbers5,983,270; 6,606,659; 6,947,985; 7,185,015; 7,194,464 and RE40,187 and other patents pending.This document may not, in whole or in part, be copied, photocopied, reproduced, translated, or reduced to any electronic medium or machine-readable form without prior consent in writing from Websense, Inc.Every effort has been made to ensure the accuracy of this manual. However, Websense, Inc., makes no warranties with respect to this documentation and disclaims any implied warranties of merchantability and fitness for a particular purpose. Websense, Inc., shall not be liable for any error or for incidental or consequential damages in connection with the furnishing, performance, or use of this manual or the examples herein. The information in this documentation is subject to change without notice.ContentsTopic 1Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4Topic 2Planning TRITON AP-DATA Deployment . . . . . . . . . . . . . . . . . . . . . 7 Deciding what data to protect. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Geographical. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Industry. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Sector. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Determining where your confidential data resides. . . . . . . . . . . . . . . . . . 9Corporate file servers and shared drives. . . . . . . . . . . . . . . . . . . . . . . 9In-house databases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Determining your information flow. . . . . . . . . . . . . . . . . . . . . . . . . . . . 10Defining the business owners for the data . . . . . . . . . . . . . . . . . . . . . . . 10Deciding who will manage incidents. . . . . . . . . . . . . . . . . . . . . . . . . . . 11Planning access control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Analyzing network structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Structural guidelines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Planning network resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Allocating disk space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Modifying the disk space setting. . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Distributing resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Most common deployments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17TRITON AP-WEB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22TRITON AP-EMAIL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23TRITON AP-DATA Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24TRITON AP-ENDPOINT DLP . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24TRITON AP-DATA Discover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Planning a phased approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Phase 1: Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Phase 2: Monitoring with notifications. . . . . . . . . . . . . . . . . . . . . . . 26Phase 3: Policy tuning. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27Phase 4: Enforcing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27TRITON AP-DATA Deployment Guide 1ContentsPhase 5: Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27Phase 6: Endpoint deployments . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Topic 3Integrating with Existing Infrastructure . . . . . . . . . . . . . . . . . . . . . . 29 Working with existing email infrastructure . . . . . . . . . . . . . . . . . . . . . . 29Working with Web proxies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Blue Coat Web proxy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34Squid open source Web proxy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44ICAP server error and response codes . . . . . . . . . . . . . . . . . . . . . . . 45 Working with shared drives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 Performing discovery on Novell file systems. . . . . . . . . . . . . . . . . . 46Performing discovery on Windows NFS shares. . . . . . . . . . . . . . . . 48 Working with user directory servers . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Configuring user directory server settings . . . . . . . . . . . . . . . . . . . . 52Importing user data . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53Rearranging servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Working with Exchange servers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53Working with IBM Domino and Notes . . . . . . . . . . . . . . . . . . . . . . . . . 58 Topic 4Scaling TRITON AP-DATA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 When does your system need to grow? . . . . . . . . . . . . . . . . . . . . . . . . . 61Adding modules to your deployment . . . . . . . . . . . . . . . . . . . . . . . . . . 64 Value of additional policy engines . . . . . . . . . . . . . . . . . . . . . . . . . . 642 TRITON AP-DATA1TRITON AP-DATA Deployment Guide 3Overview Websense ® TRITON ®AP-DATA is a comprehensive data loss prevention (DLP) system that discovers, monitors, and protects your critical information holdings, whether that data is stored on your servers, currently in use or located in off-network endpoints. The system protects against data loss by quickly analyzing data and enforcing customized policies automatically, whether users are on the network or offline. Administrators manage who can send what information, where , and how . The system can also work with TRITON AP-WEB, TRITON AP-EMAIL, and TRITON AP-ENDPOINT to protect the whole of your enterprise.The basic components of TRITON AP-DATA are:◆TRITON management server ◆Optional TRITON AP-DATA servers ◆The protector ◆Agents ◆EndpointsThe management server is the core of the system, providing complete data lossprevention analysis to the network. It gathers and stores all management statistics. For load balancing purposes, analysis can be shared among a number ofTRITON AP-DATA servers. The protector can provide added blocking capabilities to the loss-prevention system.The protector works in tandem with the TRITON management server. The TRITON management server performs discovery (performed by Crawler) and provides advanced analysis capabilities. The protector sits in the network, intercepts and analyzes traffic, and can either monitor or block traffic as needed. The protector supports analysis of SMTP, HTTP, FTP, Generic Text and IM traffic (chat and file transfer). The protector is also an integration point for third-party solutions that support ICAP. The protector fits into your existing network with minimum configuration and necessitates no network infrastructure changes.In lieu of the protector, you can combine TRITON AP-DATA with Websense Content Gateway and TRITON AP-EMAIL to block data leaks over the web and email. TRITON AP-DATA agents are also an integral part of the system. These agents are installed on the relevant servers (the ISA/TMG agent on the Microsoft ISA or TMG server, printer agent on the print server, etc.) to enable the system to access the data necessary to analyze the traffic from these servers. Modules, such as TRITON AP-OverviewENDPOINT DLP, enable administrators to analyze content within a user’s workingenvironment (PC, laptop, etc.) and block or monitor policy breaches. The mobileagent can prevent sensitive data from being synchronized from network email systemsto mobile devices.DeploymentA basic deployment might have just one management server and one protector,Content Gateway, or TRITON AP-EMAIL appliance. The protector includes severalagents, including SMTP, HTTP, FTP, IM, and ICAP. The Content Gateway providessecurity for just the web channel. TRITON AP-EMAIL provides security for just theemail channel.The servers are easily configurable to simply monitor or monitor and protect sensitivedata. It is ideal for small to medium businesses with a single Internet egress point. Thefollowing illustration is a high-level diagram of a basic deployment ofTRITON AP-DATA. Such a deployment is ideal for a smaller- to medium-sizedorganization with a single Internet egress point. Note that this illustration is intendedto show the general distribution of components and does not include network details(such as segmenting, internal firewalls, routing, switching, and so forth).4 TRITON AP-DATATRITON AP-DATA Deployment Guide 5OverviewThe following illustration is a high-level diagram of a larger deployment of TRITON AP-DATA.This shows the extended capabilities of TRITON AP-DATA incorporated into a more complex network environment. It shows an extra TRITON AP-DATA server andseveral additional agents deployed for businesses with larger transaction volumes and numbers of users. Such a deployment is suited for large organizations with multiple Internet egress points distributed over multiple geographical locations. Very large deployments can have multiple TRITON AP-DATA servers and protectors.For diagrams of the most common customer deployments, see Most common deployments , page 17.Overview6 TRITON AP-DATA2TRITON AP-DATA Deployment Guide 7Planning TRITON AP-DATADeploymentBefore you begin setting up your TRITON AP-DATA system, it is important to analyze your existing resources and define how security should be implemented to optimally benefit your specific organization. Plan your deployment by:1.Deciding what data to protect , page 72.Determining where your confidential data resides , page 93.Determining your information flow , page 104.Defining the business owners for the data , page 105.Deciding who will manage incidents , page 116.Planning access control , page 117.Analyzing network structure , page 118.Planning network resources , page 139.Planning a phased approach , page 25Deciding what data to protectWhat data should you protect? What are the applicable regulations for your organization?Answers to these questions depend on the geographical regions in which the organization operates, the industry and sector, whether it is a public company and other particulars of your organization.Consider the following:Applies to:In this topic:◆TRITON AP-DATA, v8.0.x ◆Geographical , page 8◆Industry , page 8◆Sector , page 8◆General , page 8Planning TRITON AP-DATA Deployment8 TRITON AP-DATA Geographical◆Each region may have its own regulations/laws that require protecting varioustypes of sensitive information, such as private, financial, and medical.◆Global enterprises may be bound to multiple laws if they have branch offices in different regions. (For example, they may have to abide by different state laws if they have offices in several different states)Industry◆Each type of industry may have its own laws and regulations. For example:⏹GLBA for finance ⏹HIPAA for healthcare◆If your enterprise develops new technologies, you may want to protect intellectualproperty and trade secrets (such as designs, software code, drawings, or patent applications).Sector◆Government agencies and organizations that are affiliated with the governmentare subjected to special requirements and regulations imposed by the government office, such as DIACAP for units and contractors related to the US Department of Defense and FISMA for US federal agencies and their contractors.◆For public companies, additional regulations may apply (such as the Sarbanes-Oxley Act in the U.S., or regulations that are published by the regulatory body of the relevant stock markets).General◆Most organizations want to keep their marketing information away fromcompetitors:⏹Upcoming press releases ⏹Marketing campaigns ⏹Leads ⏹Existing customer data ⏹Many organizations have individualized needs for data protection that mightnot fall into typical categories, but the system can accommodate them.The Data Security manager first-time policy wizard assists you in defining your region and industry and it displays the relevant policies, making it easier to select them. Besides predefined policies, you may want to protect specific information, such as:◆Designs ◆Drawings◆Marketing materials ◆Legal documents ◆Strategic planning documents, such as business plans ◆Financial and pricing information ◆All documents marked “Confidential”Determining where your confidential data residesBased on experience from numerous data-loss protection deployments, it’s evident that most sensitive company information resides within:◆Corporate file servers or shared drives ◆In-house databases ◆Personal laptops, workstations and removable mediaCorporate file servers and shared drivesThere are a few ways to determine where your confidential information is stored:Ask◆Talk to appropriate data owners in your organization and they may point you torelevant locations. This may cover a big part of the information that needs to be protected and is a good start. Your review of locations based on their revelations will undoubtedly reveal other critical data branchings and parallel storage places. Discover◆Use TRITON AP-DATA to classify file servers, shared drives, and endpoints byrunning it with the relevant predefined policies enabled. This should give you bulk estimations of where data is located in your enterprise.Combining the results gives you a good idea of the location of your confidential information.In-house databasesIn the case of file servers and shared drives, the best way to understand which databases are critical is:Applies to:In this topic:◆TRITON AP-DATA, v8.0.x ◆Corporate file servers and shareddrives , page 9◆In-house databases , page 9Ask◆Talk to people that manage in-house applications relying on internal databases(such as customer relations, orders processing, and accounting).◆Talk to database administrators (DBAs) and find out what are the most accesseddatabases. The more a database is accessed, the more chances there are for dataloss. Your IT department may also be able to elaborate on discoveries from bothinstances described above.Discover◆Use TRITON AP-DATA to classify databases by running it with the relevantpredefined policies enabled. This should let you know primarily where your vitalrecords are located.Based on the above information, you can narrow down the most critical databaseservers, databases and tables to protect.Determining your information flowAnalyze the flow of information through your enterprise today.◆Where is information typically coming from? Internal users? Partners? Vendors?◆Where does it need to be sent?◆What are all the potential pathways for information?◆What processes are in place, if any, to govern data flow?◆How many HTTP, SMTP and FTP exits or egress points are there in theorganization?These questions are vital to ensuring that protector(s) are placed appropriately so thatnothing escapes analysis.Defining the business owners for the dataThe business owners of information normally come from the departments where theinformation was created. For example, if you wish to protect marketing materials, thehead of marketing is normally the business owner, and should be consulted aboutdeployments. (He/she may delegate the responsibility to other people in his/herdepartment.) Normally, marketing principals—and principals from otherdepartments—would want to get notifications about data losses containinginformation originating from their department (even and especially if the sender isfrom a different department).Deciding who will manage incidentsHow should you delegate incident management across your organization?As in the case of business owners, you should identify who is responsible for datamanagement in various departments. If you are unsure who that person is, you mayeither consult with the department manager or train one of the employees that youtrust from that department.Once incident managers are identified, you can assign the proper roles and policycategory groups to the relevant users through the Data Security manager web userinterface.Planning access controlStandard network installations provide access control (preventing personnel fromviewing unauthorized files) by giving each user a login and password, and authorizingeach user to view only the network directories required for the user's job function.However, authorized users can still send content they are authorized to use tounauthorized recipients.TRITON AP-DATA augments access control by providing Information DistributionManagement (IDM) capabilities, thereby greatly enhancing the level of informationsecurity. TRITON AP-DATA protects digital content from being sent from yourcompany’s network to people outside of the company, as well as protecting classifiedinformation from being sent to unauthorized users within the local network.Typically, these user privileges were defined individually, without consideringgrouping or security clearances for groups of people. Utilizing data securitycapabilities involves delineating users as belonging to groups or security levels,enabling a more sophisticated, higher level of control over classified data.Naturally, when considering the policies discussed in this chapter, it is important toconsider how these policies are impacted by or impact other content policies in yourcompany. The Data Security manager software has the flexibility to accommodate thefull range of enterprise security needs.Analyzing network structureTo best employ TRITON AP-DATA, you need to analyze your network structure,determine the location of confidential information, note which documents need to beprotected and where they are located, and whether you need to make changes to thenetwork directory structure in order to group documents differently for securitypurposes.In most organizations, user rights have been determined and built into the networkdirectory structure, according to your organization's logic. You may conclude that thenetwork configuration is fine as it is, or that the internal network definitions change tosome degree due to today's higher security needs.Any changes you need to implement internally in the directory structure should beimplemented with these increased security measures in mind.Structural guidelinesIt is possible to configure the system so that a particular user cannot access a certaindocument through the network, but can receive the document by email. For example, amanager would not want employees to access documents in his or her personal folder,but would want to be able to send the documents to them by email. It is thereforeimportant that you perform this analysis together with the network administrator, sothat your desired changes will be implemented internally in a smooth, logical fashion,as well as within the Websense structure.Typically, your network directories are organized functionally, according to thedifferent business units in the company. Within this structure, functional groups areusually entitled to look at documents within their business unit.We recommended that you use this as your process map:◆Take a network map of all the directories, and look at how the network access isorganized◆Determine what types of classified documents you have, and where they arelocated◆Determine whether documents of similar confidentiality are together in similardirectories⏹Organize/group information that is critical to your organization andinformation whose security is legally mandated. For example, financialinstitutions may start by considering customer data (such as Social Securitynumbers or account numbers) and highly confidential business information⏹Organize/group important proprietary and confidential information withmedium or low change-frequency⏹Arrange all major information assets within your organization so that youunderstand data locations, relationships and security-value hierarchies The result of this analysis should be a table corresponding to the directories in thenetwork that need to be protected, indicating what types of users should be able toreceive those files and to provide a look at access issues.You may want to rearrange some areas of your network access, and set the datasecurity accordingly. See below for recommended procedures.Planning network resourcesTo decide on things like disk space allocation, number of servers, and network distribution, start by answering these questions:◆What volume of daily data do you expect in the number of transactions?◆What is your user count?◆Are you covering geographically distributed offices?◆What is your user directory structure (Active Directory, ADAM, Domino) and theIP addresses of the LDAP servers?◆Which ports are used and what are the port numbers?Allocating disk spaceDisk space for archiving fingerprint and forensic repositories is allocated by theTRITON AP-DATA by default. The default settings are the nominal values defined by Websense; however, you can modify these values. The tables below indicates thedefault and maximum disk space for archives, forensics repository and endpoint client incident storage, log file and fingerprint storage.Applies to:In this topic:◆TRITON AP-DATA, v8.0.x ◆Allocating disk space , page 13◆Modifying the disk space setting ,page 14◆Distributing resources , page 15On the TRITON management serverOn endpoint clientsModifying the disk space settingFollow the instructions below to modify the default disk-space settings for either archives, endpoint client incident storage, PreciseID fingerprint or forensicrepositories.To modify disk space settings:1.Access the Data Security manager and choose the Settings tab.2.Depending on the disk space to modify, do the following:a.Archives:Select Settings > Configuration > System > Archive Storage . In theMaximum archive disk space field, modify the value. Only remote archives are configurable.b.Forensics repository:Select Settings > Deployment > System Modules . In the list of modules,select the Forensics Repository entry. In the Maximum Disk Space field, set the value.c.Endpoint client (incident storage, log file and fingerprint storage):TypeDescription Default Setting Max Disk Space Archive The disk space of the incident archive folder on a local or external partition.50 GB Remote: No Max.Local: 50 GB (not configurable)Forensic repository The disk space of the forensic records stored in the archive folder.40 GBNo Max.TypeDescription Default Setting Max Disk Space Endpointclient incident storage The disk space that each endpoint client should allocate for incident storage when the endpoint host is disconnected from the TRITONManagement Server.100 MB 100 MB Endpoint client log file The disk space of the log file viewed on the endpoint client.16 MB 100 MB Endpoint client PreciseID fingerprint storage The disk space that each endpoint client should allocate for storingdirectory and SharePoint fingerprints.50 MB 1,000 MBSelect Settings > Configuration > System > Endpoint. In the sectionlabeled Disk Space, modify the relevant disk-space value.3.Click OK. The disk space values are set and changes saved.4.Click Deploy to deploy your settings.Distributing resourcesTRITON AP-DATA supports multi-site, distributed deployments. You can have alocal policy engine on the Content Gateway module, for example, and distributed(primary and secondary) fingerprint repositories.You can have a management server in one location and one or more supplementalTRITON AP-DATA servers in other locations.You can utilize the crawlers on the TRITON AP-DATA servers alone to do yourfingerprint and discovery scans, or you can install the crawler agent on additionalservers to improve performance.These are just a few of the possibilities.Your network architecture and the geographical location of your offices determinehow you will want to distribute your resources.See Most common deployments, page 17 for distributions our customers commonlyuse.Load balancingIn a multi-component system, you can configure load-balancing by selecting Settings> Deployment > System Modules in the Data Security manager and then clicking theLoad Balancing button at the top of the screen.Load balancing enables you to manage how each module sends its data to specifiedpolicy engines for analysis. This lets you distribute the load, but more important, itensures that your vital email and HTTP performance is never harmed. For example,you can designate 1-2 dedicated servers to analyze inline HTTP traffic (where analysislatency is critical) and use another set of servers to analyze other channels.An agent or a protector service can be analyzed by all listed policy engines or it can beanalyzed by specifically selected policy engines. (Note that protector services can beanalyzed only by local or Windows-based policy engines.) In addition, you can choosewhich policy engine analyzes a specific agent or service of the protector.NoteWebsense recommends that you do not distribute the loadto the TRITON management server.The Load Balancing screen shows a list of items where each item represents a protector or agent.Click each item to define which policy engine it should be analyzed by.For further information on load balancing, refer to the Data Security Manager Help.Most common deploymentsTRITON AP-DATA is a flexible system that affords you various, customizabledeployment scenarios. Each scenario is based on an organization’s practical needs and purposes—of course, individual hardware/software setups vary. Be sure to obtain guidance from your Websense sales representative to assure that the appropriate deployment option is tailored for your organization.Applies to:In this topic:◆TRITON AP-DATA, v8.0.x ◆TRITON AP-WEB, v8.0.x ◆TRITON AP-EMAIL, v8.0.x ◆TRITON AP-WEB , page 22◆TRITON AP-EMAIL , page 23◆TRITON AP-DATA Gateway ,page 24◆TRITON AP-ENDPOINT DLP ,page 24◆TRITON AP-DATA Discover ,page 25。